Canella et al.  [1]} present a comprehensive systematization and analysis of Spectre and Meltdown attacks and defenses.
They first classify transient execution attacks by whether they are a result of misprediction (Spectre) or
an execution fault (Meltdown); then they further classify the attacks by
their root microarchitectural cause, yielding the nomenclature we use in this
paper (e.g., Spectre-PHT is named for the pattern history table).
They then categorize previously known Spectre attacks, revealing several new variants and exploitation
techniques for each.
Canella et al. also propose a sequence of “phases” for a successful Spectre or Meltdown attack, and group
published defenses by the phase they target.
A followup survey by Canella et al.  [2]} expands on the idea of attack phases,
categorizing both hardware and software Spectre defenses according to which attack phase they prevent:
preparation, misspeculation, data access, data encoding, leakage, or decoding.
In contrast, our systematization focuses on the formal semantics behind Spectre analysis and mitigation tools
rather than the specifics of attack variants or types of defenses.
